ocsp_test.go

Documentation: golang.org/x/crypto/ocsp

     1  // Copyright 2013 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  //go:build go1.7
     6  
     7  package ocsp
     8  
     9  import (
    10  	"bytes"
    11  	"crypto"
    12  	"crypto/rand"
    13  	"crypto/rsa"
    14  	"crypto/sha1"
    15  	"crypto/x509"
    16  	"crypto/x509/pkix"
    17  	"encoding/asn1"
    18  	"encoding/hex"
    19  	"encoding/pem"
    20  	"math/big"
    21  	"reflect"
    22  	"testing"
    23  	"time"
    24  )
    25  
    26  func TestOCSPDecode(t *testing.T) {
    27  	responseBytes, _ := hex.DecodeString(ocspResponseHex)
    28  	resp, err := ParseResponse(responseBytes, nil)
    29  	if err != nil {
    30  		t.Fatal(err)
    31  	}
    32  
    33  	// keyHash is the SKID of the issuer of the certificate the OCSP
    34  	// response is for.
    35  	keyHash, err := hex.DecodeString("8a747faf85cdee95cd3d9cd0e24614f371351d27")
    36  	if err != nil {
    37  		t.Fatal(err)
    38  	}
    39  	// serialBytes is the serial number of the certificate the OCSP
    40  	// response is for.
    41  	serialBytes, err := hex.DecodeString("f374542e3c7a68360a00000001103462")
    42  	if err != nil {
    43  		t.Fatal(err)
    44  	}
    45  
    46  	expected := Response{
    47  		Status:           Good,
    48  		SerialNumber:     big.NewInt(0).SetBytes(serialBytes),
    49  		RevocationReason: Unspecified,
    50  		ThisUpdate:       time.Date(2021, 11, 7, 14, 25, 51, 0, time.UTC),
    51  		NextUpdate:       time.Date(2021, 11, 14, 13, 25, 50, 0, time.UTC),
    52  		ResponderKeyHash: keyHash,
    53  	}
    54  
    55  	if !reflect.DeepEqual(resp.ThisUpdate, expected.ThisUpdate) {
    56  		t.Errorf("resp.ThisUpdate: got %v, want %v", resp.ThisUpdate, expected.ThisUpdate)
    57  	}
    58  
    59  	if !reflect.DeepEqual(resp.NextUpdate, expected.NextUpdate) {
    60  		t.Errorf("resp.NextUpdate: got %v, want %v", resp.NextUpdate, expected.NextUpdate)
    61  	}
    62  
    63  	if resp.Status != expected.Status {
    64  		t.Errorf("resp.Status: got %d, want %d", resp.Status, expected.Status)
    65  	}
    66  
    67  	if resp.SerialNumber.Cmp(expected.SerialNumber) != 0 {
    68  		t.Errorf("resp.SerialNumber: got %x, want %x", resp.SerialNumber, expected.SerialNumber)
    69  	}
    70  
    71  	if resp.RevocationReason != expected.RevocationReason {
    72  		t.Errorf("resp.RevocationReason: got %d, want %d", resp.RevocationReason, expected.RevocationReason)
    73  	}
    74  
    75  	if !bytes.Equal(resp.RawResponderName, expected.RawResponderName) {
    76  		t.Errorf("resp.RawResponderName: got %x, want %x", resp.RawResponderName, expected.RawResponderName)
    77  	}
    78  
    79  	if !bytes.Equal(resp.ResponderKeyHash, expected.ResponderKeyHash) {
    80  		t.Errorf("resp.ResponderKeyHash: got %x, want %x", resp.ResponderKeyHash, expected.ResponderKeyHash)
    81  	}
    82  }
    83  
    84  func TestOCSPDecodeWithoutCert(t *testing.T) {
    85  	responseBytes, _ := hex.DecodeString(ocspResponseWithoutCertHex)
    86  	_, err := ParseResponse(responseBytes, nil)
    87  	if err != nil {
    88  		t.Error(err)
    89  	}
    90  }
    91  
    92  func TestOCSPDecodeWithExtensions(t *testing.T) {
    93  	responseBytes, _ := hex.DecodeString(ocspResponseWithCriticalExtensionHex)
    94  	_, err := ParseResponse(responseBytes, nil)
    95  	if err == nil {
    96  		t.Error(err)
    97  	}
    98  
    99  	responseBytes, _ = hex.DecodeString(ocspResponseWithExtensionHex)
   100  	response, err := ParseResponse(responseBytes, nil)
   101  	if err != nil {
   102  		t.Fatal(err)
   103  	}
   104  
   105  	if len(response.Extensions) != 1 {
   106  		t.Errorf("len(response.Extensions): got %v, want %v", len(response.Extensions), 1)
   107  	}
   108  
   109  	extensionBytes := response.Extensions[0].Value
   110  	expectedBytes, _ := hex.DecodeString(ocspExtensionValueHex)
   111  	if !bytes.Equal(extensionBytes, expectedBytes) {
   112  		t.Errorf("response.Extensions[0]: got %x, want %x", extensionBytes, expectedBytes)
   113  	}
   114  }
   115  
   116  func TestOCSPSignature(t *testing.T) {
   117  	b, _ := pem.Decode([]byte(GTSRoot))
   118  	issuer, err := x509.ParseCertificate(b.Bytes)
   119  	if err != nil {
   120  		t.Fatal(err)
   121  	}
   122  
   123  	response, _ := hex.DecodeString(ocspResponseHex)
   124  	if _, err := ParseResponse(response, issuer); err != nil {
   125  		t.Error(err)
   126  	}
   127  }
   128  
   129  func TestOCSPRequest(t *testing.T) {
   130  	leafCert, _ := hex.DecodeString(leafCertHex)
   131  	cert, err := x509.ParseCertificate(leafCert)
   132  	if err != nil {
   133  		t.Fatal(err)
   134  	}
   135  
   136  	issuerCert, _ := hex.DecodeString(issuerCertHex)
   137  	issuer, err := x509.ParseCertificate(issuerCert)
   138  	if err != nil {
   139  		t.Fatal(err)
   140  	}
   141  
   142  	request, err := CreateRequest(cert, issuer, nil)
   143  	if err != nil {
   144  		t.Fatal(err)
   145  	}
   146  
   147  	expectedBytes, _ := hex.DecodeString(ocspRequestHex)
   148  	if !bytes.Equal(request, expectedBytes) {
   149  		t.Errorf("request: got %x, wanted %x", request, expectedBytes)
   150  	}
   151  
   152  	decodedRequest, err := ParseRequest(expectedBytes)
   153  	if err != nil {
   154  		t.Fatal(err)
   155  	}
   156  
   157  	if decodedRequest.HashAlgorithm != crypto.SHA1 {
   158  		t.Errorf("request.HashAlgorithm: got %v, want %v", decodedRequest.HashAlgorithm, crypto.SHA1)
   159  	}
   160  
   161  	var publicKeyInfo struct {
   162  		Algorithm pkix.AlgorithmIdentifier
   163  		PublicKey asn1.BitString
   164  	}
   165  	_, err = asn1.Unmarshal(issuer.RawSubjectPublicKeyInfo, &publicKeyInfo)
   166  	if err != nil {
   167  		t.Fatal(err)
   168  	}
   169  
   170  	h := sha1.New()
   171  	h.Write(publicKeyInfo.PublicKey.RightAlign())
   172  	issuerKeyHash := h.Sum(nil)
   173  
   174  	h.Reset()
   175  	h.Write(issuer.RawSubject)
   176  	issuerNameHash := h.Sum(nil)
   177  
   178  	if got := decodedRequest.IssuerKeyHash; !bytes.Equal(got, issuerKeyHash) {
   179  		t.Errorf("request.IssuerKeyHash: got %x, want %x", got, issuerKeyHash)
   180  	}
   181  
   182  	if got := decodedRequest.IssuerNameHash; !bytes.Equal(got, issuerNameHash) {
   183  		t.Errorf("request.IssuerKeyHash: got %x, want %x", got, issuerNameHash)
   184  	}
   185  
   186  	if got := decodedRequest.SerialNumber; got.Cmp(cert.SerialNumber) != 0 {
   187  		t.Errorf("request.SerialNumber: got %x, want %x", got, cert.SerialNumber)
   188  	}
   189  
   190  	marshaledRequest, err := decodedRequest.Marshal()
   191  	if err != nil {
   192  		t.Fatal(err)
   193  	}
   194  
   195  	if bytes.Compare(expectedBytes, marshaledRequest) != 0 {
   196  		t.Errorf(
   197  			"Marshaled request doesn't match expected: wanted %x, got %x",
   198  			expectedBytes,
   199  			marshaledRequest,
   200  		)
   201  	}
   202  }
   203  
   204  func TestOCSPResponse(t *testing.T) {
   205  	leafCert, _ := hex.DecodeString(leafCertHex)
   206  	leaf, err := x509.ParseCertificate(leafCert)
   207  	if err != nil {
   208  		t.Fatal(err)
   209  	}
   210  
   211  	issuerCert, _ := hex.DecodeString(issuerCertHex)
   212  	issuer, err := x509.ParseCertificate(issuerCert)
   213  	if err != nil {
   214  		t.Fatal(err)
   215  	}
   216  
   217  	responderCert, _ := hex.DecodeString(responderCertHex)
   218  	responder, err := x509.ParseCertificate(responderCert)
   219  	if err != nil {
   220  		t.Fatal(err)
   221  	}
   222  
   223  	responderPrivateKeyDER, _ := hex.DecodeString(responderPrivateKeyHex)
   224  	responderPrivateKey, err := x509.ParsePKCS1PrivateKey(responderPrivateKeyDER)
   225  	if err != nil {
   226  		t.Fatal(err)
   227  	}
   228  
   229  	extensionBytes, _ := hex.DecodeString(ocspExtensionValueHex)
   230  	extensions := []pkix.Extension{
   231  		{
   232  			Id:       ocspExtensionOID,
   233  			Critical: false,
   234  			Value:    extensionBytes,
   235  		},
   236  	}
   237  
   238  	thisUpdate := time.Date(2010, 7, 7, 15, 1, 5, 0, time.UTC)
   239  	nextUpdate := time.Date(2010, 7, 7, 18, 35, 17, 0, time.UTC)
   240  	template := Response{
   241  		Status:           Revoked,
   242  		SerialNumber:     leaf.SerialNumber,
   243  		ThisUpdate:       thisUpdate,
   244  		NextUpdate:       nextUpdate,
   245  		RevokedAt:        thisUpdate,
   246  		RevocationReason: KeyCompromise,
   247  		Certificate:      responder,
   248  		ExtraExtensions:  extensions,
   249  	}
   250  
   251  	template.IssuerHash = crypto.MD5
   252  	_, err = CreateResponse(issuer, responder, template, responderPrivateKey)
   253  	if err == nil {
   254  		t.Fatal("CreateResponse didn't fail with non-valid template.IssuerHash value crypto.MD5")
   255  	}
   256  
   257  	testCases := []struct {
   258  		name       string
   259  		issuerHash crypto.Hash
   260  	}{
   261  		{"Zero value", 0},
   262  		{"crypto.SHA1", crypto.SHA1},
   263  		{"crypto.SHA256", crypto.SHA256},
   264  		{"crypto.SHA384", crypto.SHA384},
   265  		{"crypto.SHA512", crypto.SHA512},
   266  	}
   267  	for _, tc := range testCases {
   268  		t.Run(tc.name, func(t *testing.T) {
   269  			template.IssuerHash = tc.issuerHash
   270  			responseBytes, err := CreateResponse(issuer, responder, template, responderPrivateKey)
   271  			if err != nil {
   272  				t.Fatalf("CreateResponse failed: %s", err)
   273  			}
   274  
   275  			resp, err := ParseResponse(responseBytes, nil)
   276  			if err != nil {
   277  				t.Fatalf("ParseResponse failed: %s", err)
   278  			}
   279  
   280  			if !reflect.DeepEqual(resp.ThisUpdate, template.ThisUpdate) {
   281  				t.Errorf("resp.ThisUpdate: got %v, want %v", resp.ThisUpdate, template.ThisUpdate)
   282  			}
   283  
   284  			if !reflect.DeepEqual(resp.NextUpdate, template.NextUpdate) {
   285  				t.Errorf("resp.NextUpdate: got %v, want %v", resp.NextUpdate, template.NextUpdate)
   286  			}
   287  
   288  			if !reflect.DeepEqual(resp.RevokedAt, template.RevokedAt) {
   289  				t.Errorf("resp.RevokedAt: got %v, want %v", resp.RevokedAt, template.RevokedAt)
   290  			}
   291  
   292  			if !reflect.DeepEqual(resp.Extensions, template.ExtraExtensions) {
   293  				t.Errorf("resp.Extensions: got %v, want %v", resp.Extensions, template.ExtraExtensions)
   294  			}
   295  
   296  			delay := time.Since(resp.ProducedAt)
   297  			if delay < -time.Hour || delay > time.Hour {
   298  				t.Errorf("resp.ProducedAt: got %s, want close to current time (%s)", resp.ProducedAt, time.Now())
   299  			}
   300  
   301  			if resp.Status != template.Status {
   302  				t.Errorf("resp.Status: got %d, want %d", resp.Status, template.Status)
   303  			}
   304  
   305  			if resp.SerialNumber.Cmp(template.SerialNumber) != 0 {
   306  				t.Errorf("resp.SerialNumber: got %x, want %x", resp.SerialNumber, template.SerialNumber)
   307  			}
   308  
   309  			if resp.RevocationReason != template.RevocationReason {
   310  				t.Errorf("resp.RevocationReason: got %d, want %d", resp.RevocationReason, template.RevocationReason)
   311  			}
   312  
   313  			expectedHash := tc.issuerHash
   314  			if tc.issuerHash == 0 {
   315  				expectedHash = crypto.SHA1
   316  			}
   317  
   318  			if resp.IssuerHash != expectedHash {
   319  				t.Errorf("resp.IssuerHash: got %d, want %d", resp.IssuerHash, expectedHash)
   320  			}
   321  		})
   322  	}
   323  }
   324  
   325  func TestErrorResponse(t *testing.T) {
   326  	responseBytes, _ := hex.DecodeString(errorResponseHex)
   327  	_, err := ParseResponse(responseBytes, nil)
   328  
   329  	respErr, ok := err.(ResponseError)
   330  	if !ok {
   331  		t.Fatalf("expected ResponseError from ParseResponse but got %#v", err)
   332  	}
   333  	if respErr.Status != Malformed {
   334  		t.Fatalf("expected Malformed status from ParseResponse but got %d", respErr.Status)
   335  	}
   336  }
   337  
   338  func createMultiResp() ([]byte, error) {
   339  	rawResponderID := asn1.RawValue{
   340  		Class:      2, // context-specific
   341  		Tag:        1, // Name (explicit tag)
   342  		IsCompound: true,
   343  		Bytes:      []byte{48, 0},
   344  	}
   345  	tbsResponseData := responseData{
   346  		Version:        0,
   347  		RawResponderID: rawResponderID,
   348  		ProducedAt:     time.Now().Truncate(time.Minute).UTC(),
   349  	}
   350  	this := time.Now()
   351  	next := this.Add(time.Hour * 24 * 4)
   352  	for i := int64(0); i < 5; i++ {
   353  		tbsResponseData.Responses = append(tbsResponseData.Responses, singleResponse{
   354  			CertID: certID{
   355  				HashAlgorithm: pkix.AlgorithmIdentifier{
   356  					Algorithm:  hashOIDs[crypto.SHA1],
   357  					Parameters: asn1.RawValue{Tag: 5 /* ASN.1 NULL */},
   358  				},
   359  				NameHash:      []byte{1, 2, 3},
   360  				IssuerKeyHash: []byte{4, 5, 6},
   361  				SerialNumber:  big.NewInt(i),
   362  			},
   363  			ThisUpdate: this.UTC(),
   364  			NextUpdate: next.UTC(),
   365  			Good:       true,
   366  		})
   367  	}
   368  
   369  	tbsResponseDataDER, err := asn1.Marshal(tbsResponseData)
   370  	if err != nil {
   371  		return nil, err
   372  	}
   373  
   374  	k, err := rsa.GenerateKey(rand.Reader, 1024)
   375  	if err != nil {
   376  		return nil, err
   377  	}
   378  
   379  	hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(k.Public(), x509.SHA1WithRSA)
   380  	if err != nil {
   381  		return nil, err
   382  	}
   383  
   384  	responseHash := hashFunc.New()
   385  	responseHash.Write(tbsResponseDataDER)
   386  	signature, err := k.Sign(rand.Reader, responseHash.Sum(nil), hashFunc)
   387  	if err != nil {
   388  		return nil, err
   389  	}
   390  
   391  	response := basicResponse{
   392  		TBSResponseData:    tbsResponseData,
   393  		SignatureAlgorithm: signatureAlgorithm,
   394  		Signature: asn1.BitString{
   395  			Bytes:     signature,
   396  			BitLength: 8 * len(signature),
   397  		},
   398  	}
   399  	responseDER, err := asn1.Marshal(response)
   400  	if err != nil {
   401  		return nil, err
   402  	}
   403  
   404  	return asn1.Marshal(responseASN1{
   405  		Status: asn1.Enumerated(Success),
   406  		Response: responseBytes{
   407  			ResponseType: idPKIXOCSPBasic,
   408  			Response:     responseDER,
   409  		},
   410  	})
   411  }
   412  
   413  func TestOCSPDecodeMultiResponse(t *testing.T) {
   414  	respBytes, err := createMultiResp()
   415  	if err != nil {
   416  		t.Fatal(err)
   417  	}
   418  	matchingCert := &x509.Certificate{SerialNumber: big.NewInt(3)}
   419  	resp, err := ParseResponseForCert(respBytes, matchingCert, nil)
   420  	if err != nil {
   421  		t.Fatal(err)
   422  	}
   423  
   424  	if resp.SerialNumber.Cmp(matchingCert.SerialNumber) != 0 {
   425  		t.Errorf("resp.SerialNumber: got %x, want %x", resp.SerialNumber, 3)
   426  	}
   427  }
   428  
   429  func TestOCSPDecodeMultiResponseWithoutMatchingCert(t *testing.T) {
   430  	respBytes, err := createMultiResp()
   431  	if err != nil {
   432  		t.Fatal(err)
   433  	}
   434  	_, err = ParseResponseForCert(respBytes, &x509.Certificate{SerialNumber: big.NewInt(100)}, nil)
   435  	want := ParseError("no response matching the supplied certificate")
   436  	if err != want {
   437  		t.Errorf("err: got %q, want %q", err, want)
   438  	}
   439  }
   440  
   441  // This OCSP response was taken from GTS's public OCSP responder.
   442  // To recreate:
   443  //   $ openssl s_client -tls1 -showcerts -servername golang.org -connect golang.org:443
   444  // Copy and paste the first certificate into /tmp/cert.crt and the second into
   445  // /tmp/intermediate.crt
   446  // Note: depending on what version of openssl you are using, you may need to use the key=value
   447  // form for the header argument (i.e. -header host=ocsp.pki.goog)
   448  //   $ openssl ocsp -issuer /tmp/intermediate.crt -cert /tmp/cert.crt -url http://ocsp.pki.goog/gts1c3 -header host ocsp.pki.goog -resp_text -respout /tmp/ocsp.der
   449  // Then hex encode the result:
   450  //   $ python -c 'print file("/tmp/ocsp.der", "r").read().encode("hex")'
   451  
   452  const ocspResponseHex = "308201d40a0100a08201cd308201c906092b0601050507300101048201ba308201b630819fa21604148a747faf85cdee95cd3d9cd0e24614f371351d27180f32303231313130373134323535335a30743072304a300906052b0e03021a05000414c72e798addff6134b3baed4742b8bbc6c024076304148a747faf85cdee95cd3d9cd0e24614f371351d27021100f374542e3c7a68360a000000011034628000180f32303231313130373134323535315aa011180f32303231313131343133323535305a300d06092a864886f70d01010b0500038201010087749296e681abe36f2efef047730178ce57e948426959ac62ac5f25b9a63ba3b7f31b9f683aea384d21845c8dda09498f2531c78f3add3969ca4092f31f58ac3c2613719d63b7b9a5260e52814c827f8dd44f4f753b2528bcd03ccec02cdcd4918247f5323f8cfc12cee4ac8f0361587b267019cfd12336db09b04eac59807a480213cfcd9913a3aa2d13a6c88c0a750475a0e991806d94ec0fc9dab599171a43a08e6d935b4a4a13dff9c4a97ad46cef6fb4d61cb2363d788c12d81cce851b478889c2e05d80cd00ae346772a1e7502f011e2ed9be8ef4b194c8b65d6e33671d878cfb30267972075b062ff3d56b51984bf685161afc6e2538dd6e6a23063c"
   453  
   454  const GTSRoot = `-----BEGIN CERTIFICATE-----
   455  MIIFljCCA36gAwIBAgINAgO8U1lrNMcY9QFQZjANBgkqhkiG9w0BAQsFADBHMQsw
   456  CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
   457  MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjAwODEzMDAwMDQyWhcNMjcwOTMwMDAw
   458  MDQyWjBGMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
   459  Y2VzIExMQzETMBEGA1UEAxMKR1RTIENBIDFDMzCCASIwDQYJKoZIhvcNAQEBBQAD
   460  ggEPADCCAQoCggEBAPWI3+dijB43+DdCkH9sh9D7ZYIl/ejLa6T/belaI+KZ9hzp
   461  kgOZE3wJCor6QtZeViSqejOEH9Hpabu5dOxXTGZok3c3VVP+ORBNtzS7XyV3NzsX
   462  lOo85Z3VvMO0Q+sup0fvsEQRY9i0QYXdQTBIkxu/t/bgRQIh4JZCF8/ZK2VWNAcm
   463  BA2o/X3KLu/qSHw3TT8An4Pf73WELnlXXPxXbhqW//yMmqaZviXZf5YsBvcRKgKA
   464  gOtjGDxQSYflispfGStZloEAoPtR28p3CwvJlk/vcEnHXG0g/Zm0tOLKLnf9LdwL
   465  tmsTDIwZKxeWmLnwi/agJ7u2441Rj72ux5uxiZ0CAwEAAaOCAYAwggF8MA4GA1Ud
   466  DwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0T
   467  AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUinR/r4XN7pXNPZzQ4kYU83E1HScwHwYD
   468  VR0jBBgwFoAU5K8rJnEaK0gnhS9SZizv8IkTcT4waAYIKwYBBQUHAQEEXDBaMCYG
   469  CCsGAQUFBzABhhpodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHNyMTAwBggrBgEFBQcw
   470  AoYkaHR0cDovL3BraS5nb29nL3JlcG8vY2VydHMvZ3RzcjEuZGVyMDQGA1UdHwQt
   471  MCswKaAnoCWGI2h0dHA6Ly9jcmwucGtpLmdvb2cvZ3RzcjEvZ3RzcjEuY3JsMFcG
   472  A1UdIARQME4wOAYKKwYBBAHWeQIFAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3Br
   473  aS5nb29nL3JlcG9zaXRvcnkvMAgGBmeBDAECATAIBgZngQwBAgIwDQYJKoZIhvcN
   474  AQELBQADggIBAIl9rCBcDDy+mqhXlRu0rvqrpXJxtDaV/d9AEQNMwkYUuxQkq/BQ
   475  cSLbrcRuf8/xam/IgxvYzolfh2yHuKkMo5uhYpSTld9brmYZCwKWnvy15xBpPnrL
   476  RklfRuFBsdeYTWU0AIAaP0+fbH9JAIFTQaSSIYKCGvGjRFsqUBITTcFTNvNCCK9U
   477  +o53UxtkOCcXCb1YyRt8OS1b887U7ZfbFAO/CVMkH8IMBHmYJvJh8VNS/UKMG2Yr
   478  PxWhu//2m+OBmgEGcYk1KCTd4b3rGS3hSMs9WYNRtHTGnXzGsYZbr8w0xNPM1IER
   479  lQCh9BIiAfq0g3GvjLeMcySsN1PCAJA/Ef5c7TaUEDu9Ka7ixzpiO2xj2YC/WXGs
   480  Yye5TBeg2vZzFb8q3o/zpWwygTMD0IZRcZk0upONXbVRWPeyk+gB9lm+cZv9TSjO
   481  z23HFtz30dZGm6fKa+l3D/2gthsjgx0QGtkJAITgRNOidSOzNIb2ILCkXhAd4FJG
   482  AJ2xDx8hcFH1mt0G/FX0Kw4zd8NLQsLxdxP8c4CU6x+7Nz/OAipmsHMdMqUybDKw
   483  juDEI/9bfU1lcKwrmz3O2+BtjjKAvpafkmO8l7tdufThcV4q5O8DIrGKZTqPwJNl
   484  1IXNDw9bg1kWRxYtnCQ6yICmJhSFm/Y3m6xv+cXDBlHz4n/FsRC6UfTd
   485  -----END CERTIFICATE-----`
   486  
   487  const startComHex = "308206343082041ca003020102020118300d06092a864886f70d0101050500307d310b30" +
   488  	"0906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b" +
   489  	"3029060355040b1322536563757265204469676974616c20436572746966696361746520" +
   490  	"5369676e696e6731293027060355040313205374617274436f6d20436572746966696361" +
   491  	"74696f6e20417574686f72697479301e170d3037313032343230353431375a170d313731" +
   492  	"3032343230353431375a30818c310b300906035504061302494c31163014060355040a13" +
   493  	"0d5374617274436f6d204c74642e312b3029060355040b13225365637572652044696769" +
   494  	"74616c204365727469666963617465205369676e696e67313830360603550403132f5374" +
   495  	"617274436f6d20436c6173732031205072696d61727920496e7465726d65646961746520" +
   496  	"53657276657220434130820122300d06092a864886f70d01010105000382010f00308201" +
   497  	"0a0282010100b689c6acef09527807ac9263d0f44418188480561f91aee187fa3250b4d3" +
   498  	"4706f0e6075f700e10f71dc0ce103634855a0f92ac83c6ac58523fba38e8fce7a724e240" +
   499  	"a60876c0926e9e2a6d4d3f6e61200adb59ded27d63b33e46fefa215118d7cd30a6ed076e" +
   500  	"3b7087b4f9faebee823c056f92f7a4dc0a301e9373fe07cad75f809d225852ae06da8b87" +
   501  	"2369b0e42ad8ea83d2bdf371db705a280faf5a387045123f304dcd3baf17e50fcba0a95d" +
   502  	"48aab16150cb34cd3c5cc30be810c08c9bf0030362feb26c3e720eee1c432ac9480e5739" +
   503  	"c43121c810c12c87fe5495521f523c31129b7fe7c0a0a559d5e28f3ef0d5a8e1d77031a9" +
   504  	"c4b3cfaf6d532f06f4a70203010001a38201ad308201a9300f0603551d130101ff040530" +
   505  	"030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414eb4234d098" +
   506  	"b0ab9ff41b6b08f7cc642eef0e2c45301f0603551d230418301680144e0bef1aa4405ba5" +
   507  	"17698730ca346843d041aef2306606082b06010505070101045a3058302706082b060105" +
   508  	"05073001861b687474703a2f2f6f6373702e737461727473736c2e636f6d2f6361302d06" +
   509  	"082b060105050730028621687474703a2f2f7777772e737461727473736c2e636f6d2f73" +
   510  	"667363612e637274305b0603551d1f045430523027a025a0238621687474703a2f2f7777" +
   511  	"772e737461727473736c2e636f6d2f73667363612e63726c3027a025a023862168747470" +
   512  	"3a2f2f63726c2e737461727473736c2e636f6d2f73667363612e63726c3081800603551d" +
   513  	"20047930773075060b2b0601040181b5370102013066302e06082b060105050702011622" +
   514  	"687474703a2f2f7777772e737461727473736c2e636f6d2f706f6c6963792e7064663034" +
   515  	"06082b060105050702011628687474703a2f2f7777772e737461727473736c2e636f6d2f" +
   516  	"696e7465726d6564696174652e706466300d06092a864886f70d01010505000382020100" +
   517  	"2109493ea5886ee00b8b48da314d8ff75657a2e1d36257e9b556f38545753be5501f048b" +
   518  	"e6a05a3ee700ae85d0fbff200364cbad02e1c69172f8a34dd6dee8cc3fa18aa2e37c37a7" +
   519  	"c64f8f35d6f4d66e067bdd21d9cf56ffcb302249fe8904f385e5aaf1e71fe875904dddf9" +
   520  	"46f74234f745580c110d84b0c6da5d3ef9019ee7e1da5595be741c7bfc4d144fac7e5547" +
   521  	"7d7bf4a50d491e95e8f712c1ccff76a62547d0f37535be97b75816ebaa5c786fec5330af" +
   522  	"ea044dcca902e3f0b60412f630b1113d904e5664d7dc3c435f7339ef4baf87ebf6fe6888" +
   523  	"4472ead207c669b0c1a18bef1749d761b145485f3b2021e95bb2ccf4d7e931f50b15613b" +
   524  	"7a94e3ebd9bc7f94ae6ae3626296a8647cb887f399327e92a252bebbf865cfc9f230fc8b" +
   525  	"c1c2a696d75f89e15c3480f58f47072fb491bfb1a27e5f4b5ad05b9f248605515a690365" +
   526  	"434971c5e06f94346bf61bd8a9b04c7e53eb8f48dfca33b548fa364a1a53a6330cd089cd" +
   527  	"4915cd89313c90c072d7654b52358a461144b93d8e2865a63e799e5c084429adb035112e" +
   528  	"214eb8d2e7103e5d8483b3c3c2e4d2c6fd094b7409ddf1b3d3193e800da20b19f038e7c5" +
   529  	"c2afe223db61e29d5c6e2089492e236ab262c145b49faf8ba7f1223bf87de290d07a19fb" +
   530  	"4a4ce3d27d5f4a8303ed27d6239e6b8db459a2d9ef6c8229dd75193c3f4c108defbb7527" +
   531  	"d2ae83a7a8ce5ba7"
   532  
   533  const ocspResponseWithoutCertHex = "308201d40a0100a08201cd308201c906092b0601050507300101048201ba3082" +
   534  	"01b630819fa2160414884451ff502a695e2d88f421bad90cf2cecbea7c180f3230313330" +
   535  	"3631383037323434335a30743072304a300906052b0e03021a0500041448b60d38238df8" +
   536  	"456e4ee5843ea394111802979f0414884451ff502a695e2d88f421bad90cf2cecbea7c02" +
   537  	"1100f78b13b946fc9635d8ab49de9d2148218000180f3230313330363138303732343433" +
   538  	"5aa011180f32303133303632323037323434335a300d06092a864886f70d010105050003" +
   539  	"82010100103e18b3d297a5e7a6c07a4fc52ac46a15c0eba96f3be17f0ffe84de5b8c8e05" +
   540  	"5a8f577586a849dc4abd6440eb6fedde4622451e2823c1cbf3558b4e8184959c9fe96eff" +
   541  	"8bc5f95866c58c6d087519faabfdae37e11d9874f1bc0db292208f645dd848185e4dd38b" +
   542  	"6a8547dfa7b74d514a8470015719064d35476b95bebb03d4d2845c5ca15202d2784878f2" +
   543  	"0f904c24f09736f044609e9c271381713400e563023d212db422236440c6f377bbf24b2b" +
   544  	"9e7dec8698e36a8df68b7592ad3489fb2937afb90eb85d2aa96b81c94c25057dbd4759d9" +
   545  	"20a1a65c7f0b6427a224b3c98edd96b9b61f706099951188b0289555ad30a216fb774651" +
   546  	"5a35fca2e054dfa8"
   547  
   548  // PKIX nonce extension
   549  var ocspExtensionOID = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 2}
   550  var ocspExtensionValueHex = "0403000000"
   551  
   552  const ocspResponseWithCriticalExtensionHex = "308204fe0a0100a08204f7308204f306092b0601050507300101048204e4308204e03081" +
   553  	"dba003020100a11b3019311730150603550403130e4f43535020526573706f6e64657218" +
   554  	"0f32303136303130343137303130305a3081a53081a23049300906052b0e03021a050004" +
   555  	"14c0fe0278fc99188891b3f212e9c7e1b21ab7bfc004140dfc1df0a9e0f01ce7f2b21317" +
   556  	"7e6f8d157cd4f60210017f77deb3bcbb235d44ccc7dba62e72a116180f32303130303730" +
   557  	"373135303130355aa0030a0101180f32303130303730373135303130355aa011180f3230" +
   558  	"3130303730373138333531375aa1193017301506092b06010505073001020101ff040504" +
   559  	"03000000300d06092a864886f70d01010b0500038201010031c730ca60a7a0d92d8e4010" +
   560  	"911b469de95b4d27e89de6537552436237967694f76f701cf6b45c932bd308bca4a8d092" +
   561  	"5c604ba94796903091d9e6c000178e72c1f0a24a277dd262835af5d17d3f9d7869606c9f" +
   562  	"e7c8e708a41645699895beee38bfa63bb46296683761c5d1d65439b8ab868dc3017c9eeb" +
   563  	"b70b82dbf3a31c55b457d48bb9e82b335ed49f445042eaf606b06a3e0639824924c89c63" +
   564  	"eccddfe85e6694314138b2536f5e15e07085d0f6e26d4b2f8244bab0d70de07283ac6384" +
   565  	"a0501fc3dea7cf0adfd4c7f34871080900e252ddc403e3f0265f2a704af905d3727504ed" +
   566  	"28f3214a219d898a022463c78439799ca81c8cbafdbcec34ea937cd6a08202ea308202e6" +
   567  	"308202e2308201caa003020102020101300d06092a864886f70d01010b05003019311730" +
   568  	"150603550403130e4f43535020526573706f6e646572301e170d31353031333031353530" +
   569  	"33335a170d3136303133303135353033335a3019311730150603550403130e4f43535020" +
   570  	"526573706f6e64657230820122300d06092a864886f70d01010105000382010f00308201" +
   571  	"0a0282010100e8155f2d3e6f2e8d14c62a788bd462f9f844e7a6977c83ef1099f0f6616e" +
   572  	"c5265b56f356e62c5400f0b06a2e7945a82752c636df32a895152d6074df1701dc6ccfbc" +
   573  	"bec75a70bd2b55ae2be7e6cad3b5fd4cd5b7790ab401a436d3f5f346074ffde8a99d5b72" +
   574  	"3350f0a112076614b12ef79c78991b119453445acf2416ab0046b540db14c9fc0f27b898" +
   575  	"9ad0f63aa4b8aefc91aa8a72160c36307c60fec78a93d3fddf4259902aa77e7332971c7d" +
   576  	"285b6a04f648993c6922a3e9da9adf5f81508c3228791843e5d49f24db2f1290bafd97e6" +
   577  	"55b1049a199f652cd603c4fafa330c390b0da78fbbc67e8fa021cbd74eb96222b12ace31" +
   578  	"a77dcf920334dc94581b0203010001a3353033300e0603551d0f0101ff04040302078030" +
   579  	"130603551d25040c300a06082b06010505070309300c0603551d130101ff04023000300d" +
   580  	"06092a864886f70d01010b05000382010100718012761b5063e18f0dc44644d8e6ab8612" +
   581  	"31c15fd5357805425d82aec1de85bf6d3e30fce205e3e3b8b795bbe52e40a439286d2288" +
   582  	"9064f4aeeb150359b9425f1da51b3a5c939018555d13ac42c565a0603786a919328f3267" +
   583  	"09dce52c22ad958ecb7873b9771d1148b1c4be2efe80ba868919fc9f68b6090c2f33c156" +
   584  	"d67156e42766a50b5d51e79637b7e58af74c2a951b1e642fa7741fec982cc937de37eff5" +
   585  	"9e2005d5939bfc031589ca143e6e8ab83f40ee08cc20a6b4a95a318352c28d18528dcaf9" +
   586  	"66705de17afa19d6e8ae91ddf33179d16ebb6ac2c69cae8373d408ebf8c55308be6c04d9" +
   587  	"3a25439a94299a65a709756c7a3e568be049d5c38839"
   588  
   589  const ocspResponseWithExtensionHex = "308204fb0a0100a08204f4308204f006092b0601050507300101048204e1308204dd3081" +
   590  	"d8a003020100a11b3019311730150603550403130e4f43535020526573706f6e64657218" +
   591  	"0f32303136303130343136353930305a3081a230819f3049300906052b0e03021a050004" +
   592  	"14c0fe0278fc99188891b3f212e9c7e1b21ab7bfc004140dfc1df0a9e0f01ce7f2b21317" +
   593  	"7e6f8d157cd4f60210017f77deb3bcbb235d44ccc7dba62e72a116180f32303130303730" +
   594  	"373135303130355aa0030a0101180f32303130303730373135303130355aa011180f3230" +
   595  	"3130303730373138333531375aa1163014301206092b0601050507300102040504030000" +
   596  	"00300d06092a864886f70d01010b05000382010100c09a33e0b2324c852421bb83f85ac9" +
   597  	"9113f5426012bd2d2279a8166e9241d18a33c870894250622ffc7ed0c4601b16d624f90b" +
   598  	"779265442cdb6868cf40ab304ab4b66e7315ed02cf663b1601d1d4751772b31bc299db23" +
   599  	"9aebac78ed6797c06ed815a7a8d18d63cfbb609cafb47ec2e89e37db255216eb09307848" +
   600  	"d01be0a3e943653c78212b96ff524b74c9ec456b17cdfb950cc97645c577b2e09ff41dde" +
   601  	"b03afb3adaa381cc0f7c1d95663ef22a0f72f2c45613ae8e2b2d1efc96e8463c7d1d8a1d" +
   602  	"7e3b35df8fe73a301fc3f804b942b2b3afa337ff105fc1462b7b1c1d75eb4566c8665e59" +
   603  	"f80393b0adbf8004ff6c3327ed34f007cb4a3348a7d55e06e3a08202ea308202e6308202" +
   604  	"e2308201caa003020102020101300d06092a864886f70d01010b05003019311730150603" +
   605  	"550403130e4f43535020526573706f6e646572301e170d3135303133303135353033335a" +
   606  	"170d3136303133303135353033335a3019311730150603550403130e4f43535020526573" +
   607  	"706f6e64657230820122300d06092a864886f70d01010105000382010f003082010a0282" +
   608  	"010100e8155f2d3e6f2e8d14c62a788bd462f9f844e7a6977c83ef1099f0f6616ec5265b" +
   609  	"56f356e62c5400f0b06a2e7945a82752c636df32a895152d6074df1701dc6ccfbcbec75a" +
   610  	"70bd2b55ae2be7e6cad3b5fd4cd5b7790ab401a436d3f5f346074ffde8a99d5b723350f0" +
   611  	"a112076614b12ef79c78991b119453445acf2416ab0046b540db14c9fc0f27b8989ad0f6" +
   612  	"3aa4b8aefc91aa8a72160c36307c60fec78a93d3fddf4259902aa77e7332971c7d285b6a" +
   613  	"04f648993c6922a3e9da9adf5f81508c3228791843e5d49f24db2f1290bafd97e655b104" +
   614  	"9a199f652cd603c4fafa330c390b0da78fbbc67e8fa021cbd74eb96222b12ace31a77dcf" +
   615  	"920334dc94581b0203010001a3353033300e0603551d0f0101ff04040302078030130603" +
   616  	"551d25040c300a06082b06010505070309300c0603551d130101ff04023000300d06092a" +
   617  	"864886f70d01010b05000382010100718012761b5063e18f0dc44644d8e6ab861231c15f" +
   618  	"d5357805425d82aec1de85bf6d3e30fce205e3e3b8b795bbe52e40a439286d22889064f4" +
   619  	"aeeb150359b9425f1da51b3a5c939018555d13ac42c565a0603786a919328f326709dce5" +
   620  	"2c22ad958ecb7873b9771d1148b1c4be2efe80ba868919fc9f68b6090c2f33c156d67156" +
   621  	"e42766a50b5d51e79637b7e58af74c2a951b1e642fa7741fec982cc937de37eff59e2005" +
   622  	"d5939bfc031589ca143e6e8ab83f40ee08cc20a6b4a95a318352c28d18528dcaf966705d" +
   623  	"e17afa19d6e8ae91ddf33179d16ebb6ac2c69cae8373d408ebf8c55308be6c04d93a2543" +
   624  	"9a94299a65a709756c7a3e568be049d5c38839"
   625  
   626  const ocspRequestHex = "3051304f304d304b3049300906052b0e03021a05000414c0fe0278fc99188891b3f212e9" +
   627  	"c7e1b21ab7bfc004140dfc1df0a9e0f01ce7f2b213177e6f8d157cd4f60210017f77deb3" +
   628  	"bcbb235d44ccc7dba62e72"
   629  
   630  const leafCertHex = "308203c830820331a0030201020210017f77deb3bcbb235d44ccc7dba62e72300d06092a" +
   631  	"864886f70d01010505003081ba311f301d060355040a1316566572695369676e20547275" +
   632  	"7374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31" +
   633  	"333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572" +
   634  	"766572204341202d20436c617373203331493047060355040b13407777772e7665726973" +
   635  	"69676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459" +
   636  	"204c54442e286329393720566572695369676e301e170d3132303632313030303030305a" +
   637  	"170d3133313233313233353935395a3068310b3009060355040613025553311330110603" +
   638  	"550408130a43616c69666f726e6961311230100603550407130950616c6f20416c746f31" +
   639  	"173015060355040a130e46616365626f6f6b2c20496e632e311730150603550403140e2a" +
   640  	"2e66616365626f6f6b2e636f6d30819f300d06092a864886f70d010101050003818d0030" +
   641  	"818902818100ae94b171e2deccc1693e051063240102e0689ae83c39b6b3e74b97d48d7b" +
   642  	"23689100b0b496ee62f0e6d356bcf4aa0f50643402f5d1766aa972835a7564723f39bbef" +
   643  	"5290ded9bcdbf9d3d55dfad23aa03dc604c54d29cf1d4b3bdbd1a809cfae47b44c7eae17" +
   644  	"c5109bee24a9cf4a8d911bb0fd0415ae4c3f430aa12a557e2ae10203010001a382011e30" +
   645  	"82011a30090603551d130402300030440603551d20043d303b3039060b6086480186f845" +
   646  	"01071703302a302806082b06010505070201161c68747470733a2f2f7777772e76657269" +
   647  	"7369676e2e636f6d2f727061303c0603551d1f043530333031a02fa02d862b687474703a" +
   648  	"2f2f535652496e746c2d63726c2e766572697369676e2e636f6d2f535652496e746c2e63" +
   649  	"726c301d0603551d250416301406082b0601050507030106082b06010505070302300b06" +
   650  	"03551d0f0404030205a0303406082b0601050507010104283026302406082b0601050507" +
   651  	"30018618687474703a2f2f6f6373702e766572697369676e2e636f6d30270603551d1104" +
   652  	"20301e820e2a2e66616365626f6f6b2e636f6d820c66616365626f6f6b2e636f6d300d06" +
   653  	"092a864886f70d0101050500038181005b6c2b75f8ed30aa51aad36aba595e555141951f" +
   654  	"81a53b447910ac1f76ff78fc2781616b58f3122afc1c87010425e9ed43df1a7ba6498060" +
   655  	"67e2688af03db58c7df4ee03309a6afc247ccb134dc33e54c6bc1d5133a532a73273b1d7" +
   656  	"9cadc08e7e1a83116d34523340b0305427a21742827c98916698ee7eaf8c3bdd71700817"
   657  
   658  const issuerCertHex = "30820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a" +
   659  	"864886f70d0101050500305f310b300906035504061302555331173015060355040a130e" +
   660  	"566572695369676e2c20496e632e31373035060355040b132e436c617373203320507562" +
   661  	"6c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930" +
   662  	"1e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f" +
   663  	"301d060355040a1316566572695369676e205472757374204e6574776f726b3117301506" +
   664  	"0355040b130e566572695369676e2c20496e632e31333031060355040b132a5665726953" +
   665  	"69676e20496e7465726e6174696f6e616c20536572766572204341202d20436c61737320" +
   666  	"3331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e63" +
   667  	"6f72702e6279205265662e204c494142494c495459204c54442e28632939372056657269" +
   668  	"5369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280" +
   669  	"e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1" +
   670  	"bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f530" +
   671  	"3e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3a" +
   672  	"f9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d1304" +
   673  	"0830060101ff02010030440603551d20043d303b3039060b6086480186f8450107010130" +
   674  	"2a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e" +
   675  	"636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507" +
   676  	"030206096086480186f8420401060a6086480186f845010801300b0603551d0f04040302" +
   677  	"0106301106096086480186f842010104040302010630310603551d1f042a30283026a024" +
   678  	"a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c" +
   679  	"300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062" +
   680  	"adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6" +
   681  	"f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6" +
   682  	"e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75" +
   683  	"d68071"
   684  
   685  // Key and certificate for the OCSP responder were not taken from the Thawte
   686  // responder, since CreateResponse requires that we have the private key.
   687  // Instead, they were generated randomly.
   688  const responderPrivateKeyHex = "308204a40201000282010100e8155f2d3e6f2e8d14c62a788bd462f9f844e7a6977c83ef" +
   689  	"1099f0f6616ec5265b56f356e62c5400f0b06a2e7945a82752c636df32a895152d6074df" +
   690  	"1701dc6ccfbcbec75a70bd2b55ae2be7e6cad3b5fd4cd5b7790ab401a436d3f5f346074f" +
   691  	"fde8a99d5b723350f0a112076614b12ef79c78991b119453445acf2416ab0046b540db14" +
   692  	"c9fc0f27b8989ad0f63aa4b8aefc91aa8a72160c36307c60fec78a93d3fddf4259902aa7" +
   693  	"7e7332971c7d285b6a04f648993c6922a3e9da9adf5f81508c3228791843e5d49f24db2f" +
   694  	"1290bafd97e655b1049a199f652cd603c4fafa330c390b0da78fbbc67e8fa021cbd74eb9" +
   695  	"6222b12ace31a77dcf920334dc94581b02030100010282010100bcf0b93d7238bda329a8" +
   696  	"72e7149f61bcb37c154330ccb3f42a85c9002c2e2bdea039d77d8581cd19bed94078794e" +
   697  	"56293d601547fc4bf6a2f9002fe5772b92b21b254403b403585e3130cc99ccf08f0ef81a" +
   698  	"575b38f597ba4660448b54f44bfbb97072b5a2bf043bfeca828cf7741d13698e3f38162b" +
   699  	"679faa646b82abd9a72c5c7d722c5fc577a76d2c2daac588accad18516d1bbad10b0dfa2" +
   700  	"05cfe246b59e28608a43942e1b71b0c80498075121de5b900d727c31c42c78cf1db5c0aa" +
   701  	"5b491e10ea4ed5c0962aaf2ae025dd81fa4ce490d9d6b4a4465411d8e542fc88617e5695" +
   702  	"1aa4fc8ea166f2b4d0eb89ef17f2b206bd5f1014bf8fe0e71fe62f2cccf102818100f2dc" +
   703  	"ddf878d553286daad68bac4070a82ffec3dc4666a2750f47879eec913f91836f1d976b60" +
   704  	"daf9356e078446dafab5bd2e489e5d64f8572ba24a4ba4f3729b5e106c4dd831cc2497a7" +
   705  	"e6c7507df05cb64aeb1bbc81c1e340d58b5964cf39cff84ea30c29ec5d3f005ee1362698" +
   706  	"07395037955955655292c3e85f6187fa1f9502818100f4a33c102630840705f8c778a47b" +
   707  	"87e8da31e68809af981ac5e5999cf1551685d761cdf0d6520361b99aebd5777a940fa64d" +
   708  	"327c09fa63746fbb3247ec73a86edf115f1fe5c83598db803881ade71c33c6e956118345" +
   709  	"497b98b5e07bb5be75971465ec78f2f9467e1b74956ca9d4c7c3e314e742a72d8b33889c" +
   710  	"6c093a466cef0281801d3df0d02124766dd0be98349b19eb36a508c4e679e793ba0a8bef" +
   711  	"4d786888c1e9947078b1ea28938716677b4ad8c5052af12eb73ac194915264a913709a0b" +
   712  	"7b9f98d4a18edd781a13d49899f91c20dbd8eb2e61d991ba19b5cdc08893f5cb9d39e5a6" +
   713  	"0629ea16d426244673b1b3ee72bd30e41fac8395acac40077403de5efd028180050731dd" +
   714  	"d71b1a2b96c8d538ba90bb6b62c8b1c74c03aae9a9f59d21a7a82b0d572ef06fa9c807bf" +
   715  	"c373d6b30d809c7871df96510c577421d9860c7383fda0919ece19996b3ca13562159193" +
   716  	"c0c246471e287f975e8e57034e5136aaf44254e2650def3d51292474c515b1588969112e" +
   717  	"0a85cc77073e9d64d2c2fc497844284b02818100d71d63eabf416cf677401ebf965f8314" +
   718  	"120b568a57dd3bd9116c629c40dc0c6948bab3a13cc544c31c7da40e76132ef5dd3f7534" +
   719  	"45a635930c74326ae3df0edd1bfb1523e3aa259873ac7cf1ac31151ec8f37b528c275622" +
   720  	"48f99b8bed59fd4da2576aa6ee20d93a684900bf907e80c66d6e2261ae15e55284b4ed9d" +
   721  	"6bdaa059"
   722  
   723  const responderCertHex = "308202e2308201caa003020102020101300d06092a864886f70d01010b05003019311730" +
   724  	"150603550403130e4f43535020526573706f6e646572301e170d31353031333031353530" +
   725  	"33335a170d3136303133303135353033335a3019311730150603550403130e4f43535020" +
   726  	"526573706f6e64657230820122300d06092a864886f70d01010105000382010f00308201" +
   727  	"0a0282010100e8155f2d3e6f2e8d14c62a788bd462f9f844e7a6977c83ef1099f0f6616e" +
   728  	"c5265b56f356e62c5400f0b06a2e7945a82752c636df32a895152d6074df1701dc6ccfbc" +
   729  	"bec75a70bd2b55ae2be7e6cad3b5fd4cd5b7790ab401a436d3f5f346074ffde8a99d5b72" +
   730  	"3350f0a112076614b12ef79c78991b119453445acf2416ab0046b540db14c9fc0f27b898" +
   731  	"9ad0f63aa4b8aefc91aa8a72160c36307c60fec78a93d3fddf4259902aa77e7332971c7d" +
   732  	"285b6a04f648993c6922a3e9da9adf5f81508c3228791843e5d49f24db2f1290bafd97e6" +
   733  	"55b1049a199f652cd603c4fafa330c390b0da78fbbc67e8fa021cbd74eb96222b12ace31" +
   734  	"a77dcf920334dc94581b0203010001a3353033300e0603551d0f0101ff04040302078030" +
   735  	"130603551d25040c300a06082b06010505070309300c0603551d130101ff04023000300d" +
   736  	"06092a864886f70d01010b05000382010100718012761b5063e18f0dc44644d8e6ab8612" +
   737  	"31c15fd5357805425d82aec1de85bf6d3e30fce205e3e3b8b795bbe52e40a439286d2288" +
   738  	"9064f4aeeb150359b9425f1da51b3a5c939018555d13ac42c565a0603786a919328f3267" +
   739  	"09dce52c22ad958ecb7873b9771d1148b1c4be2efe80ba868919fc9f68b6090c2f33c156" +
   740  	"d67156e42766a50b5d51e79637b7e58af74c2a951b1e642fa7741fec982cc937de37eff5" +
   741  	"9e2005d5939bfc031589ca143e6e8ab83f40ee08cc20a6b4a95a318352c28d18528dcaf9" +
   742  	"66705de17afa19d6e8ae91ddf33179d16ebb6ac2c69cae8373d408ebf8c55308be6c04d9" +
   743  	"3a25439a94299a65a709756c7a3e568be049d5c38839"
   744  
   745  const errorResponseHex = "30030a0101"
   746
View as plain text